[AVRO-3658] Bump jackson to address CVE-2020-36518

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.11.1
• Fix Version/s: 1.12.0
• Component/s: java
• Labels: pull-request-available
• Assignee: Martin Tzvetanov Grigorov
• Reporter: Pavel Moskotin
• Created: 28/Oct/22 18:28
• Updated: 14/Nov/22 11:53
• Resolved: 08/Nov/22 12:05

Description

Current version of Jackson dependency for AVRO/Java

<jackson-bom.version>2.12.7.20221012</jackson-bom.version>

brings CVE-2020-36518.

This is covered by next versions, for example - in

<jackson-bom.version>2.13.4</jackson-bom.version>

Issue Links

• links to: GitHub Pull Request #1937
• links to: GitHub Pull Request #1944